How to secure query strings in php ?

Question

the urlencode and urldecode functions are there, but if you have an encoded value that can be easily decoded using the urldecode function.

Is there any other method which can be used to make the query string stronger and less prone to attacks. using hashing would be fine but if can try not to use too much compute.

What type of security do you want? The consumption of the url-encoded arguments is where security needs to be addressed, and that's a matter of validating untrusted and untrustable inputs. Or, you could be trying to do what Oshawott is speaking to in his answer. — Tetsujin no Oni, Apr 24 '13 at 21:34

score 1 · Accepted Answer · answered Apr 24 '13 at 21:34

1

It sounds like you're talking about URL strings rather than query strings. The best way to secure variables which you don't want the user to see is to use POST actions instead of GET actions.

The purpose of urlencode is not to provide security, it's to encode strings which may contain special characters etc. to pass in a GET request.

POST does not store the variables as a part of the URL or in the browser history, so it's much better for sending sensitive information. If you want to actually secure the information against user manipulation, you'll have to hash or encrypt it (for example, passwords should be hashed before posting).

POST vs GET comparison

answered Apr 24 '13 at 21:34

Glitch Desire

14,632
7
43
55

I don't think using POST can save something – Royal Bg Apr 24 '13 at 21:36
If thinking of security - use HTTPS (SSL) instead of http! – bestprogrammerintheworld Apr 24 '13 at 21:41
Totally different type of security (protecting against external sniffing rather than user manipulation), but also useful. – Glitch Desire Apr 24 '13 at 21:43

score 1 · Answer 2 · answered Apr 24 '13 at 21:35

1

Keep in mind that even using POST, you're not really hiding anything from someone who wants to get at that data. Be very careful of what kind of data you allow to be sent in GET and POST. Know that no matter which you choose, it can still be manipulated by the end user.

answered Apr 24 '13 at 21:35

Lawson

624
1
5
19

how to secure at the user end... sanitizing the input can only be done at the server end – Abhishek Aug 02 '14 at 18:51
Sanitizing input is useful, but you really should be locking it down more than that (for instance, using CFQUERYPARAM in ColdFusion.) – Lawson Aug 03 '14 at 19:54

score 0 · Answer 3 · edited May 23 '17 at 11:49

0

Guessing this is what you're wanting to look at. This will show you how to "clean" input from users, whether it's from the query-string or not.

I'm not sure how POST'ing the variables is any safer at all... Chrome Dev Tools will get around that no problem.

edited May 23 '17 at 11:49

Community

1
1

answered Apr 24 '13 at 21:35

AlbertEngelB

16,016
15
66
93

How to secure query strings in php ?

3 Answers3